Hands-on emulator lab · 6–10 min
Filter suspicious web requests carefully — AWS WAF
Create a web firewall rule in count mode before considering blocking.
These actions use an isolated AWS Emulator. It stores API state locally; it does not create paid cloud resources or run the full hosted AWS service.
Your goal
Create a web firewall rule in count mode before considering blocking.
Why this matters
A new firewall rule should be inspected before it blocks visitors. You will create a counting rule and verify its action. This is saved configuration, not a security test against live traffic.
Words you will use
A web ACL is a collection of request rules. A managed rule group provides maintained rules. Count mode records matches without blocking them. A false positive blocks harmless traffic.
How to proceed
Start a fresh emulator, read each numbered step, and enter the practice settings shown. Run the action, inspect its API receipt, then continue. Finish lab checks the emulator state again before saving your progress.
1. Create a web ACL
Create a regional web access control list with an allow default. An ACL is a collection of rules. This practice ACL is not attached to a public application.
2. Add a counting rule
Add a rule that looks for the word practice in a URI path. Use Count so matching requests would be counted rather than blocked. Saving a rule does not prove it is accurate for real traffic.
3. Inspect the rule action
Read the web ACL and find the Count action. This lab verifies rule configuration. It does not send attacks or test a real application firewall.
Practice, then check your understanding
Perform the actions yourself and inspect the returned state. Errors keep your settings so you can retry. Starting another lab clears the previous live environment. Earned XP is kept, and signed-in achievements sync to your account. Replay does not award duplicate XP.
Read the official AWS documentation for service behavior and production details.